Function detect_identity_collision 

pub fn detect_identity_collision(
    self_identity: &str,
    self_repo_key: &str,
    self_name: &str,
    existing: &[ExistingIdentity],
) -> Option<String>

Detect whether a SnapshotPolicy’s resolved identity collides with an already-admitted policy’s identity in the same repository (ADR-0005 §6). Pure so the decision is unit-tested; the webhook does the IO (list policies, resolve each identity) and calls this. Returns the conflicting namespace/name or None.

• self_name is the candidate’s own namespace/name, skipped so a re-apply of the same object never collides with itself.
• A collision requires BOTH the same repo_key AND the same identity string.

use kopiur_api::validate::{detect_identity_collision, ExistingIdentity};

let existing = vec![ExistingIdentity {
    identity: "pg@billing:/pvc/data".into(),
    repo_key: "ClusterRepository/shared".into(),
    name: "billing/pg-a".into(),
}];
// Same identity + same repo, different policy → collision.
assert_eq!(
    detect_identity_collision("pg@billing:/pvc/data", "ClusterRepository/shared", "billing/pg-b", &existing),
    Some("billing/pg-a".to_string()),
);
// Same identity but a DIFFERENT repository → no collision (separate snapshot history).
assert_eq!(
    detect_identity_collision("pg@billing:/pvc/data", "Repository/billing/nas", "billing/pg-b", &existing),
    None,
);
// Self (same name) is skipped.
assert_eq!(
    detect_identity_collision("pg@billing:/pvc/data", "ClusterRepository/shared", "billing/pg-a", &existing),
    None,
);